@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.37

package/test/intake-relay.test.ts

@@ -1,5 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
+import { randomBytes } from 'node:crypto'
 import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -8,6 +9,7 @@ import { once } from 'node:events'
 import type { Update } from 'grammy/types'
 import { createRelay } from '../src/index.js'
 import { ControlStore } from '../src/control-state.js'
+import { ApplicationBindings } from '../src/application-channel.js'
 import { RunStore } from '../src/runs.js'
 import { InboxStore } from '../src/inbox.js'
 import { ApprovalStore } from '../src/approval.js'
@@ -113,7 +115,9 @@ test('approved owner group accepts different members, controls and group deliver
     await control.revokeOwner()
     await f.relay.bot.handleUpdate(group(1))
     assert.equal(f.launched.length, 0)
-    assert.equal((await control.status()).pending[0].title, 'Team')
+    const request = (await control.status()).pending[0]
+    if (!request || !('title' in request)) throw new Error('Group pairing request missing')
+    assert.equal(request.title, 'Team')
     await control.approveOwner(-101, true)
     await f.relay.bot.handleUpdate(group(2, 303))
     await f.relay.bot.handleUpdate(group(3, 404))
@@ -263,7 +267,7 @@ test('conversation menu is owner-only and removes the retired settings control',
   try {
     await f.relay.bot.handleUpdate(message(1, '/menu'))
     assert.deepEqual(f.keyboards.at(-1)!.flat().map((b) => b.text),
-      ['New conversation', 'Conversations', 'Choose AI', 'Work status'])
+      ['New conversation', 'Conversations', 'Choose AI', 'Work status', 'Scheduled tasks'])
     await f.relay.bot.handleUpdate(message(2, '/settings'))
     assert.match(f.replies.at(-1)!, /Settings was removed.*Use \/ai/)
     await f.relay.bot.handleUpdate(message(3, '/ai'))
@@ -284,9 +288,11 @@ test('conversation menu is owner-only and removes the retired settings control',
     assert.match(f.replies.at(-1)!, /Menu expired/)
     assert.deepEqual(await store.status(), refreshed)
     await f.relay.bot.handleUpdate(message(8, '/status'))
-    assert.ok(f.keyboards.at(-1)!.flat().some((button) => button.text === 'Scheduled tasks'))
-    await f.relay.bot.handleUpdate(callback(9, 'menu:scheduled-tasks'))
-    assert.match(f.replies.at(-1)!, /No active scheduled tasks for this owner/)
+    assert.ok(!f.keyboards.at(-1)!.flat().some((button) => button.text === 'Scheduled tasks'))
+    await f.relay.bot.handleUpdate(message(9, '/tasks'))
+    assert.match(f.replies.at(-1)!, /📅 Scheduled tasks[\s\S]*No active scheduled tasks/)
+    await f.relay.bot.handleUpdate(message(10, '/tasks 2'))
+    assert.match(f.replies.at(-1)!, /Scheduled task 2 was not found/)
     assert.equal(f.launched.length, 0)
   } finally { await f.close() }
 })
@@ -386,7 +392,7 @@ test('slow voice normalization preserves instruction order and leaves controls r
     release()
     await processing
     assert.equal(f.launched[0][0], 'Use the following voice note')
-    assert.match(f.launched[0][1], /Quoted context/)
+    assert.doesNotMatch(f.launched[0][1], /Quoted context/)
     assert.match(f.launched[0][1], /Fixture voice transcript/)
     assert.equal(f.launched[0].length, 2)
     assert.equal((await new InboxStore(f.dir).status()).pending, 1)
@@ -632,7 +638,7 @@ test('conversation menu paginates and stale pages remain usable after archiving'
 })
 
 
-test('older conversation names come from owner messages and detail keeps archive available when resume fails', async () => {
+test('conversation names never read run history and detail keeps archive available when resume fails', async () => {
   const f = await fixture()
   try {
     const store = new ControlStore(f.dir, 1000)
@@ -649,7 +655,8 @@ test('older conversation names come from owner messages and detail keeps archive
     await store.resetSession()
     await f.relay.bot.handleUpdate(message(1, '/chats'))
     const rows = f.keyboards.at(-1)!
-    assert.ok(rows.flat().some(b => b.text.startsWith('Client launch checklist · ')))
+    assert.ok(rows.flat().some(b => b.text.startsWith('Untitled conversation')))
+    assert.ok(!rows.flat().some(b => b.text.includes('Client launch checklist')))
     assert.ok(!rows.flat().some(b => b.text === '✓ New conversation'))
     assert.ok(!rows.flat().some(b => b.text.includes(old.sessionId.slice(0, 8))))
     assert.ok(!rows.flat().some(b => b.callback_data.startsWith('chat:archive:')))
@@ -657,7 +664,7 @@ test('older conversation names come from owner messages and detail keeps archive
       id: '2', chat_instance: 'fixture', data: `chat:open:${old.sessionId}`,
       from: { id: 101, first_name: 'Fixture', is_bot: false }, message: message(2).message!,
     } })
-    assert.match(f.replies.at(-1)!, /Client launch checklist.*\n.*binding/)
+    assert.match(f.replies.at(-1)!, /Untitled conversation \d+[\s\S]*binding/)
     assert.deepEqual(f.keyboards.at(-1)![0], [{text: 'Archive this conversation', callback_data: `chat:archive:${old.sessionId}`}])
   } finally { await f.close() }
 })
@@ -680,7 +687,7 @@ test('Telegram and application image/PDF/text use identical native attachment me
       const telegram=(await new RunStore(f.dir).list()).find(run=>run.messageId===update.message!.message_id)!
       assert.ok(telegram)
       const application=await f.relay.applicationChannel.submit(binding.bindingId,{requestId:name,scope:'chat',followOwner:true,text:update.message!.caption,attachment:{name,data:bytes.toString('base64')}})
-      const normalize=(text:string)=>text.replace(/inbox\/[a-f0-9-]+_/,'inbox/ID_')
+      const normalize=(text:string)=>text.replace(/attachments\/[a-f0-9-]+_/,'attachments/ID_')
       assert.equal(normalize(application.texts[0]),normalize(telegram.texts[0]))
       assert.equal(application.ownerId,telegram.ownerId)
       assert.equal(application.execution?.sessionId,telegram.execution?.sessionId)
@@ -699,9 +706,49 @@ test('web launcher is private-owner-only and bypasses native intake without repl
     await f.relay.bot.handleUpdate(message(2,'/voice'))
     assert.deepEqual(f.keyboards.at(-1),[[{text:'Voice',web_app:{url:'https://voice.example/'}}]])
     await f.relay.bot.handleUpdate(message(3,'/menu'))
-    assert.deepEqual(f.keyboards.at(-1)!.flat().map(b=>b.text),['New conversation','Conversations','Choose AI','Work status','Voice'])
+    assert.deepEqual(f.keyboards.at(-1)!.flat().map(b=>b.text),['New conversation','Conversations','Choose AI','Work status','Scheduled tasks','Voice'])
     await f.relay.drainInbox(true);assert.equal(f.launched.length,0)
     await new ControlStore(f.dir,1000).revokeOwner()
     const before=f.keyboards.length;await f.relay.bot.handleUpdate(message(4,'/voice'));assert.equal(f.keyboards.length,before)
   } finally {await f.close()}
 })
+
+test('application Telegram link connects without launching work; bad link replies expired', async () => {
+  const f=await fixture()
+  try {
+    const control=new ControlStore(f.dir,1000)
+    await control.revokeOwner()
+    const owner=await control.registerOwner('account:web')
+    const binding=await new ApplicationBindings(f.dir).register('webapp',randomBytes(32).toString('base64url'),owner,true)
+    assert.ok(binding)
+    const pairing=await control.createApplicationTelegramPairing(binding.bindingId,owner)
+    assert.ok(pairing)
+    await f.relay.bot.handleUpdate(message(1,`/start ${'A'.repeat(43)}`))
+    assert.match(f.replies.at(-1)!,/expired|no longer valid/)
+    assert.equal(f.launched.length,0)
+    await f.relay.bot.handleUpdate(message(2,`/start ${pairing.token}`))
+    assert.match(f.replies.at(-1)! ,/connected/)
+    assert.equal(f.launched.length,0)
+    assert.equal((await control.status()).owner?.telegramUserId,101)
+  } finally {await f.close()}
+})
+
+test('tasks command never reaches the executor on invalid input or foreign senders', async () => {
+  const f = await fixture()
+  try {
+    const stranger = message(1, '/tasks');stranger.message!.from!.id = 202
+    await f.relay.bot.handleUpdate(stranger)
+    assert.equal(f.launched.length, 0)
+    assert.ok(!f.replies.join('\n').includes('Scheduled tasks'))
+    const strangerDetail = message(2, '/tasks 1');strangerDetail.message!.from!.id = 202
+    await f.relay.bot.handleUpdate(strangerDetail)
+    assert.equal(f.launched.length, 0)
+    assert.ok(!f.replies.join('\n').includes('Scheduled tasks'))
+    for (const [id, text] of [[3, '/tasks 0'], [4, '/tasks abc'], [5, '/tasks 1.5'], [6, '/tasks 2 extra']] as const) {
+      await f.relay.bot.handleUpdate(message(id, text))
+      assert.match(f.replies.at(-1)!, /Usage: \/tasks \[number\]/)
+    }
+    await f.relay.drainInbox(true)
+    assert.equal(f.launched.length, 0)
+  } finally { await f.close() }
+})

package/test/message-history.test.ts

@@ -1,45 +1,42 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, readFile, writeFile, readdir } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import { execFile } from 'node:child_process'
 import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { deliveredMessages } from '../src/message-history.js'
 import { RunStore } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 
 async function fixture(t: test.TestContext) {
   const dir = await mkdtemp(join(tmpdir(), 'ez-history-'))
-  t.after(() => rm(dir, { recursive: true, force: true }))
+  // Child CLI assertions below reach the memory ledger through the socket.
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
   await ownerRun(dir, 'tg_1')
   const runs = new RunStore(dir)
-  const patchFixture = async (id: string, patch: Record<string, unknown>) => {
-    const file = join(dir, 'runs', id + '.json')
-    await writeFile(file, JSON.stringify({ ...JSON.parse(await readFile(file, 'utf8')), ...patch }))
-  }
   const send = async (runId: string, text: string, ids: number[]) => {
     const item = await runs.enqueueMessage(runId, text)
     await runs.claimOutbox(item.id)
     await runs.markOutboxSent(item.id, ids)
-    return join(dir, 'outbox', item.id + '.sent.json')
+    return item
   }
-  return { dir, runs, send, patchFixture }
+  return { dir, runs, send }
 }
 
 test('CLI retrieves Synopsys delivery from another session without changing sessions or sending', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
-  await ownerRun(dir, 'r_schedule_report')
+  const { dir, runs, send } = await fixture(t)
   const owner = (await new ControlStore(dir, 1000).status()).owner!
-  await patchFixture('r_schedule_report', { nativeSessionId: 'report_session', scheduled: {
-    id: 's_earnings', revision: 1, dueAt: new Date().toISOString(), pairedAt: owner.pairedAt,
-  } })
+  const report = await runs.create({ id: 'r_schedule_report', chatId: 101, telegramUserId: 101, texts: ['quarterly results'],
+    execution: { sessionId: 'report_session', preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } },
+    scheduled: { id: 's_earnings', revision: 'rev', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
+  await runs.patch(report.id, { status: 'running', nativeSessionId: 'report_session' })
   await send('r_schedule_report', 'Synopsys (SNPS): quarterly results', [10, 11])
   await runs.patch('r_schedule_report', { status: 'completed' })
-  await patchFixture('tg_1', { texts: ['Why now?'] })
   await send('tg_1', 'Other report', [12])
-  const before = await readdir(join(dir, 'outbox'))
   const controlBefore = await new ControlStore(dir, 1000).status()
   const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-message.mjs', 'history', '--message-id', '11'], {
     env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'tg_1' },
@@ -51,51 +48,49 @@ test('CLI retrieves Synopsys delivery from another session without changing sess
   assert.equal(result.messages[0].scheduleId, 's_earnings')
   assert.deepEqual(result.messages[0].messageIds, [10, 11])
   assert.deepEqual(await new ControlStore(dir, 1000).status(), controlBefore)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
   const latest = await deliveredMessages(dir, 'tg_1', { limit: 1 })
   assert.equal(latest.messages[0].text, 'Other report')
   assert.equal(latest.hasMore, true)
 })
 
 test('only confirmed deliveries in current owner binding are exposed', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
+  const { dir, runs, send } = await fixture(t)
   await send('tg_1', 'included', [1])
   await runs.enqueueMessage('tg_1', 'pending')
   const failed = await runs.enqueueMessage('tg_1', 'uncertain')
   await runs.claimOutbox(failed.id)
   await runs.failOutbox(failed.id, 'unknown', true)
-  await writeFile(join(dir, 'outbox', 'corrupt.sent.json'), '{')
-  await writeFile(join(dir, 'outbox', 'null.sent.json'), 'null')
-  const invalid = await send('tg_1', 'invalid receipt', [2])
-  const record = JSON.parse(await readFile(invalid, 'utf8'))
-  record.receipt.messageIds = []
-  await writeFile(invalid, JSON.stringify(record))
-  for (const [id, patch] of [
-    ['r_other_chat', { chatId: 202 }],
-    ['r_other_owner', { telegramUserId: 202 }],
-    ['r_old', { createdAt: '2000-01-01T00:00:00.000Z' }],
-    ['r_external', { external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } }],
-  ] as const) {
-    await ownerRun(dir, id)
-    await patchFixture(id, patch)
-    await send(id, 'excluded', [3])
+  // Receipts without usable message IDs are not delivery evidence.
+  const invalid = await runs.enqueueMessage('tg_1', 'invalid receipt')
+  await runs.claimOutbox(invalid.id)
+  await runs.markOutboxSent(invalid.id, [])
+  for (const input of [
+    { id: 'r_other_chat', chatId: 202, telegramUserId: 101 },
+    { id: 'r_other_owner', chatId: 101, telegramUserId: 202 },
+    { id: 'r_external', chatId: 101, telegramUserId: 101, external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } },
+  ]) {
+    await runs.create({ ...input, texts: ['excluded'] })
+    await runs.patch(input.id, { status: 'running' })
+    await send(input.id, 'excluded', [3])
   }
   assert.deepEqual((await deliveredMessages(dir, 'tg_1')).messages.map(m => m.text), ['included'])
-  await writeFile(join(dir, 'runs', 'broken.json'), '{')
   assert.equal((await deliveredMessages(dir, 'tg_1')).messages.length, 1)
 })
 
 test('unauthorized callers and invalid arguments fail closed', async t => {
-  const { dir, runs, patchFixture } = await fixture(t)
+  const { dir, runs } = await fixture(t)
   for (const limit of [0, 51, NaN, 1.5]) await assert.rejects(deliveredMessages(dir, 'tg_1', { limit }), /Limit/)
   await assert.rejects(deliveredMessages(dir, 'tg_1', { messageId: -1 }), /Message ID/)
   await assert.rejects(deliveredMessages(dir, '../tg_1'), /identifier/)
   await assert.rejects(deliveredMessages(dir, 'missing'), /No active/)
   await ownerRun(dir, 'r_external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
   await assert.rejects(deliveredMessages(dir, 'r_external'), /blocked/)
-  await patchFixture('tg_1', { telegramUserId: 202 })
-  await assert.rejects(deliveredMessages(dir, 'tg_1'), /owner-mismatch/)
-  await patchFixture('tg_1', { telegramUserId: 101, status: 'completed' })
+  await runs.create({ id: 'r_stranger', chatId: 101, telegramUserId: 202, texts: ['other'] })
+  await runs.patch('r_stranger', { status: 'running' })
+  await assert.rejects(deliveredMessages(dir, 'r_stranger'), /owner-mismatch/)
+  await runs.patch('tg_1', { status: 'completed' })
   await assert.rejects(deliveredMessages(dir, 'tg_1'), /No active/)
   await runs.patch('tg_1', { status: 'running' })
   await new ControlStore(dir, 1000).revokeOwner()
@@ -103,14 +98,11 @@ test('unauthorized callers and invalid arguments fail closed', async t => {
 })
 
 test('approval messages retain the content delivered to Telegram', async t => {
-  const { dir, send } = await fixture(t)
-  const file = await send('tg_1', 'placeholder', [20])
-  const item = JSON.parse(await readFile(file, 'utf8'))
-  delete item.text
-  item.type = 'approval'
-  item.approvalPrompt = 'Approve this messaging task?'
-  await writeFile(file, JSON.stringify(item))
-  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, item.approvalPrompt)
+  const { dir, runs } = await fixture(t)
+  const item = await runs.enqueueApproval('tg_1', 'Approve this messaging task?', 'act_history')
+  await runs.claimOutbox(item.id)
+  await runs.markOutboxSent(item.id, [20])
+  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, 'Approve this messaging task?')
 })
 
 test('CLI flushes complete long reports and rejects send options in history mode', async t => {
@@ -121,7 +113,7 @@ test('CLI flushes complete long reports and rejects send options in history mode
   const cli = [ 'bin/ezenciel-agents-message.mjs', 'history' ]
   const { stdout } = await promisify(execFile)(process.execPath, cli, { env })
   assert.equal(JSON.parse(stdout).messages[0].text, text)
-  const before = await readdir(join(dir, 'outbox'))
   await assert.rejects(promisify(execFile)(process.execPath, [...cli, '--text', 'do not send'], { env }), /Unknown option/)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
 })

package/test/native-tasks.test.ts

@@ -16,7 +16,7 @@ test('native tasks use verified control binding, sanitized environment and uncha
     const binding=await nativeTaskBinding(home,{HOME:root,PATH:process.env.PATH,TELEGRAM_BOT_TOKEN:'secret',EZ_RUN_ID:'forged',NODE_OPTIONS:'injection',EZ_CONTROL_DIR:'/wrong'})
     assert.equal(binding.cwd,workspace);assert.equal(binding.env.EZ_CONTROL_DIR,controlDir);assert.equal(binding.env.EZ_EXECUTOR_CLI,'grok')
     for(const key of ['TELEGRAM_BOT_TOKEN','EZ_RUN_ID','NODE_OPTIONS'])assert.equal(binding.env[key],undefined)
-    assert.match((await nativeTasks(home,['--help'])).stdout,/durable, asynchronous CLI task/)
+    assert.match((await nativeTasks(home,['--help'])).stdout,/Creates a scheduled task/)
     const denied=await nativeTasks(home,['list']);assert.notEqual(denied.code,0);assert.match(denied.stderr,/Pair an owner/)
     const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
     const text='Read scan; $(must-not-run) /goal literal'

package/test/plugin-broker.test.mjs

@@ -0,0 +1,172 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import { createConnection } from 'node:net';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js';
+import { RunStore } from '../src/runs.js';
+import { loadPluginBrokerBinding, servePluginBroker, validateBrokerRequest } from '../src/plugin-broker.mjs';
+
+const hash = value => createHash('sha256').update(value).digest('hex');
+const revision = 'sha256:' + 'a'.repeat(64);
+
+test('relay compose surface has no broker Docker socket or tools-home mount', async () => {
+  const compose = await fs.readFile(new URL('../compose.yaml', import.meta.url), 'utf8');
+  const relay = compose.slice(0, compose.indexOf('  plugin-broker:'));
+  assert.equal(relay.includes('/var/run/docker.sock'), false);
+  assert.equal(relay.includes('EZ_TOOLS_HOME'), false);
+  assert.equal(compose.slice(compose.indexOf('  plugin-broker:')).includes('/var/run/docker.sock'), true);
+});
+
+async function fixture(t) {
+  const root = await fs.realpath(await fs.mkdtemp(path.join(tmpdir(), 'e-')));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  const home = path.join(root, 'tools');
+  const workspace = path.join(root, 'mind');
+  const controlDir = path.join(root, 'control');
+  const hostConfig = path.join(root, 'host-executor.json');
+  const socket = path.join(controlDir, 'plugin-broker.sock');
+  const source = path.join(home, 'packages', 'sample', revision.slice(7));
+  await Promise.all([home, workspace, controlDir, source].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.mkdir(path.join(root, 'bin'), { mode: 0o700 });
+  const host = { cli: 'codex', isolation: 'isolated', agents: [{ name: 'tenant-a', toolsHome: home, workspace, controlDir, binDir: path.join(root, 'bin') }] };
+  await fs.writeFile(hostConfig, JSON.stringify(host) + '\n', { mode: 0o600 });
+  const realHost = await fs.realpath(hostConfig);
+  const realHome = await fs.realpath(home);
+  const realWorkspace = await fs.realpath(workspace);
+  const realControl = await fs.realpath(controlDir);
+  await fs.writeFile(path.join(home, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: realWorkspace, hostConfig: realHost }) + '\n', { mode: 0o600 });
+  const record = {
+    revision,
+    source,
+    project: `ezp-${hash(realHome).slice(0, 16)}-sample`,
+    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: [] },
+    deployment: { schemaVersion: 1, services: { sample: { buildTarget: 'runtime', volumes: {}, workspace: false, healthcheck: ['node', '--version'] } }, commands: { sample: { service: 'sample', argv: ['node', '/app/client.mjs'], suffix: [] } }, exports: {} },
+    compose: path.join(home, 'packages', 'sample', 'compose.json'),
+  };
+  await fs.writeFile(path.join(home, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: realHome, plugins: { sample: record }, commands: { sample: 'sample' } }) + '\n', { mode: 0o600 });
+  const fake = path.join(root, 'fake');
+  await fs.mkdir(fake, { mode: 0o700 });
+  await fs.writeFile(path.join(fake, 'docker'), `#!${process.execPath}
+const a=process.argv.slice(2);
+if(a.includes('loud'))process.stdout.write('x'.repeat(1024*1024+1));
+else if(a.includes('run'))process.stdout.write('broker-ok');
+`, { mode: 0o700 });
+  const control = new ControlStore(realControl, 1000);
+  await control.requestPairing(42, 42);
+  const owner = await control.approveOwner(42);
+  const run = await new RunStore(realControl).create({ id: 'r_broker', chatId: 42, telegramUserId: 42, texts: ['broker test'], ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner) });
+  await new RunStore(realControl).patch(run.id, { status: 'running' });
+  return { root, home: realHome, workspace: realWorkspace, controlDir: realControl, hostConfig: realHost, socket, runId: run.id, fake };
+}
+
+async function request(socketPath, payload) {
+  return new Promise((resolve, reject) => {
+    const socket = createConnection(socketPath);
+    let buffer = '';
+    socket.once('error', reject);
+    socket.on('data', chunk => {
+      buffer += chunk.toString();
+      const end = buffer.indexOf('\n');
+      if (end < 0) return;
+      try { resolve(JSON.parse(buffer.slice(0, end))); } catch (error) { reject(error); }
+      socket.destroy();
+    });
+    socket.on('connect', () => socket.end(JSON.stringify(payload) + '\n'));
+  });
+}
+
+async function waitForSocket(socketPath) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { if ((await fs.stat(socketPath)).isSocket()) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+  throw new Error('Broker socket did not start');
+}
+
+test('isolated broker authenticates an owned run, pins plugin revision, and writes receipts', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const previousPath = process.env.PATH;
+  process.env.PATH = f.fake + path.delimiter + previousPath;
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const published = JSON.parse(await fs.readFile(path.join(f.controlDir, 'plugin-broker-plugins.json'), 'utf8'));
+    assert.deepEqual(published.plugins, [{ id: 'sample', version: '1.0.0' }]);
+    const listed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list'] });
+    assert.equal(listed.ok, true);
+    assert.deepEqual(JSON.parse(listed.stdout), { sample: 'sample' });
+    const detailed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list', '--details'] });
+    assert.equal(detailed.ok, true);
+    assert.deepEqual(JSON.parse(detailed.stdout).sample.commands, ['ez sample --help']);
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, true);
+    assert.equal(resolved.revision, revision);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: ['literal', '$(not-a-shell)'], stdin: 'input' });
+    assert.equal(invoked.ok, true);
+    assert.equal(invoked.stdout, 'broker-ok');
+    assert.equal(invoked.receipt.status, 'completed');
+    assert.deepEqual(JSON.parse(await fs.readFile(invoked.receiptPath, 'utf8')), invoked.receipt);
+    const replay = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: [] });
+    assert.equal(replay.ok, false);
+    assert.match(replay.error, /capability/);
+    const loudResolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    const loud = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: loudResolved.capability, args: ['loud'] });
+    assert.equal(loud.ok, false);
+    assert.match(loud.error, /output limit/);
+    assert.equal(loud.receipt.status, 'failed');
+    const generated = JSON.parse(await fs.readFile(f.home + '/packages/sample/compose.json', 'utf8'));
+    assert.equal(generated.version, '3.8');
+  } finally {
+    abort.abort();
+    await serving;
+    process.env.PATH = previousPath;
+  }
+});
+
+test('broker rejects foreign agent bindings and unsafe management or request fields', async t => {
+  const f = await fixture(t);
+  const foreign = path.join(f.root, 'foreign');
+  const foreignHome = path.join(foreign, 'tools');
+  const foreignWorkspace = path.join(foreign, 'mind');
+  const foreignControl = path.join(foreign, 'control');
+  await Promise.all([foreignHome, foreignWorkspace, foreignControl].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.writeFile(path.join(foreignHome, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: await fs.realpath(foreignWorkspace), hostConfig: f.hostConfig }));
+  await fs.writeFile(path.join(foreignHome, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: await fs.realpath(foreignHome), plugins: {}, commands: {} }));
+  await assert.rejects(loadPluginBrokerBinding({ home: foreignHome, workspace: foreignWorkspace, controlDir: foreignControl, socket: path.join(foreignControl, 'plugin-broker.sock'), hostConfig: f.hostConfig }), /owned by exactly one isolated agent/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'install', 'sample', '--source', '/tmp/plugin'] }), /not allowed/);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'uninstall', 'sample'] }, f.workspace));
+  const source = path.join(f.workspace, 'plugin-source');
+  await fs.mkdir(source);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', source, '--revision', revision] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', '/tmp/plugin', '--revision', revision] }, f.workspace), /agent workspace/);
+  const candidate = path.join(source, 'candidate.tgz');
+  await fs.writeFile(candidate, 'candidate');
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', candidate] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', '/tmp/candidate.tgz'] }, f.workspace), /agent workspace/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--version', '1.0.1'] }, f.workspace), /not allowed/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'short', args: [] }), /capability/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'a'.repeat(48), args: [], stdin: 'x'.repeat(1024 * 1024 + 1) }), /stdin/);
+});
+
+test('broker rejects resolve and invoke for a revoked run', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    await new RunStore(f.controlDir).patch(f.runId, { status: 'cancelled' });
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, false);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: 'a'.repeat(64), args: [] });
+    assert.equal(invoked.ok, false);
+  } finally {
+    abort.abort();
+    await serving;
+  }
+});